blocks|key|2255092|text|通常，敏感信息必须存储在服务器端--记住，用户可以自由地读取和修改cookie。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2255093|您可能看到的是会话cookie，它将特定客户端绑定到服务器上的特定会话-这是为了让服务器知道要为您使用哪个会话。在这种情况下，cookie包含的唯一内容是一个长的随机会话ID+-它是长的随机的，所以攻击者不容易猜到它。|2255094|窃取另一个用户的会话cookie的行为称为session+hijacking。|offset|length|2255095|其他信息：|2255096|PHP手册中的|2255097|Cookie+VS+Session|unordered-list-item|2255098|Session+chapter+|2255099|2255100|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/5081025/php-session-fixation-hijacking|1|https://stackoverflow.com/questions/6253633/cookie-vs-session|2|http://php.net/manual/en/features.sessions.php^0|0|0|L|H|0|0|0|0|0|H|1|0|0|F|2|0|0^^$0|@$1|2|3|4|5|6|7|13|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|14|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|15|8|@]|9|@$F|16|G|17|1|18]]|A|$]]|$1|H|3|I|5|6|7|19|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|1A|8|@]|9|@]|A|$]]|$1|L|3|M|5|N|7|1B|8|@]|9|@$F|1C|G|1D|1|1E]]|A|$]]|$1|O|3|P|5|N|7|1F|8|@]|9|@$F|1G|G|1H|1|1I]]|A|$]]|$1|Q|3|-4|5|6|7|1J|8|@]|9|@]|A|$]]|$1|R|3|-4|5|6|7|1K|8|@]|9|@]|A|$]]]|S|$T|$5|U|V|W|A|$X|Y]]|Z|$5|U|V|W|A|$X|10]]|11|$5|U|V|W|A|$X|12]]]]

Generally, sensitive information like which user is currently logged in must be stored on server side - remember, cookies can be freely read and altered by the user. 

What you are probably seeing is the session cookie that ties a specific client to a specific session on the server - that is so the server knows which session to use for you. In this case, the only thing the cookie contains is a long, random session ID - it's long and random so it can't be easily guessed by an attacker. 

The act of stealing another user's session cookie is called <a href="https://stackoverflow.com/questions/5081025/php-session-fixation-hijacking">session hijacking</a>. 

Additional info:

<ul>
<li><a href="https://stackoverflow.com/questions/6253633/cookie-vs-session">Cookie VS Session</a></li>
<li><a href="http://php.net/manual/en/features.sessions.php" rel="nofollow noreferrer">Session chapter</a> in the PHP manual</li>
</ul>

blocks|key|2255106|text|它们将服务器端会话与cookie结合使用。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2255107|cookie包含一个ID，该ID被发送到FaceBook，服务器将检查具有该ID的会话的详细信息。|2255108|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

They use server-side sessions in conjunction with a cookie.

The cookie holds an ID, this ID is sent to FaceBook and the server checks the details for the session with that ID.

blocks|key|5381594|text|我认为$_sessions背后的想法是，服务器处理自己的信息要快得多，效率也高得多，而不是从客户端接收大量信息。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|5381595|这样看：|5381596|你(服务器)和一个朋友(客户端)在闲聊你的另一个朋友辛迪，你的朋友会给你关于她的每一个细节信息(发色，身高，等等)吗？不，那是浪费时间。对于你来说，处理你已经知道的关于Cindy的信息(在$_session文件中，服务器端)，并且只从你的朋友(客户端)那里接收唯一的信息($_cookies)，对你来说要快得多。|5381597|效率：“嘿，你听说辛迪昨晚做了什么了吗？”|5381598|效率不高：“嘿，你有没有听到昨晚那个棕色头发，蓝眼睛，中等身材的辛迪做了什么？”|5381599|显然，本文并没有完全概括$_sessions和$_cookies，但也许可以帮助人们理解有效的短期数据管理。|5381600|entityMap^0|3|A|0|0|2M|9|3S|9|0|0|0|C|A|N|9|0^^$0|@$1|2|3|4|5|6|7|R|8|@$9|S|A|T|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|U|8|@]|D|@]|E|$]]|$1|H|3|I|5|6|7|V|8|@$9|W|A|X|B|C]|$9|Y|A|Z|B|C]]|D|@]|E|$]]|$1|J|3|K|5|6|7|10|8|@]|D|@]|E|$]]|$1|L|3|M|5|6|7|11|8|@]|D|@]|E|$]]|$1|N|3|O|5|6|7|12|8|@$9|13|A|14|B|C]|$9|15|A|16|B|C]]|D|@]|E|$]]|$1|P|3|-4|5|6|7|17|8|@]|D|@]|E|$]]]|Q|$]]

I think the idea behind <code>$_sessions</code> is it's much faster and efficient for the server to process its own information, rather than receive bulk information from the client.

Look at it this way:

You (the server) and a friend (the client) are gossiping about your other friend Cindy, does you friend give you every detail of information about her (hair color, height, etc...)? No, that would be a waste of time. It's much faster for you to process the information you already know about Cindy (on the <code>$_session</code> file, server-side) and only receive unique information (<code>$_cookies</code>) from your friend (the client).

Efficient: "Hey, did you hear what Cindy did last night?"

NOT efficient: "Hey did you hear what Cindy with brown hair, blue eye, medium build, etc... did last night?"

Obviously, this doesn't fully summarize <code>$_sessions</code> and <code>$_cookies</code>, but maybe it will help someone understand efficient short-term data management.

blocks|key|2249514|text|他们使用会话，然后将一些信息存储到session_id中，例如，user_id使用session_id+=+.../登录，然后检查该cookie的会话，以查看用户是否仍在登录。我认为这是对资源的浪费。在我看来，我将关键信息存储到会话中，将大信息存储到cookie中|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2249515|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

They probalby use sessions and then store some information into cookies, like, user_id is logged in with session_id = .../ then check in session for that session_id to see if the user is still logged in.
I think it is a waste of resources. In my opinion i store critical info into sessions and big info into cookies

blocks|key|3270396|text|我认为服务器端会话数据存储。如果您希望持久地存储用户数据，则需要将其写入服务器端数据存储(例如，关系数据库、NoSQL键值存储等)。查找关键字通常是cookie+ID或登录ID。为了加快查找速度，您可以在其前面放置一个缓存层(例如，Memcache，Redis)。这样做的好处是，您可以存储任意大/复杂的每用户数据集。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3270397|Source|offset|length|3270398|entityMap|0|LINK|mutability|MUTABLE|url|http://qr.ae/TUTxT7^0|0|0|6|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@$D|P|E|Q|1|R]]|A|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|M]]]]

I think Server-Side session data stores. If you want to store user data persistently, you'll need to write it into a server-side data store (e.g., a relational database, a NoSQL key-value store, etc.). The lookup key will typically be either a cookie ID or a login ID. To speed up lookups, you can put a caching layer in front of it (e.g., Memcache, Redis). The advantage is that you can store an arbitrarily large / complex set of per-user data. 

<a href="http://qr.ae/TUTxT7" rel="nofollow noreferrer">Source</a>

Do websites like Facebook store logged in users in cookies (client side) or sessions (server side)? My tests indicate that they do the first.

Do websites like Facebook store logged in users in cookies or sessions?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

像Facebook这样的网站会在cookies (客户端)或sessions (服务器端)中存储登录用户吗？我的测试表明他们做了第一个。

问像Facebook这样的网站会在cookie或会话中登录用户吗？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问像Facebook这样的网站会在cookie或会话中登录用户吗？EN